CVE-2024-53257 Vitess allows HTML injection in /debug/querylogz & /debug/env
Attackers can inject HTML into Vitess debug pages via unescaped queries, potentially leading to script execution in admin browsers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53257?
CVE-2024-53257 is a medium-severity cross-site scripting vulnerability in vitessio vitess, published on 3 Dec 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.
Weakness: CWE-79
Which versions are affected by CVE-2024-53257?
7 open source packages ship an affected version, including vitess.io/vitess.
| Package | Affected | Fixed in |
|---|---|---|
vitess.io/vitess Go | All versions | 0.19.8, 0.20.4, 0.21.1 |
vitess.io/vitess Go | All versions | 0.19.8 |
vitess.io/vitess Go | All versions | 0.19.8 |
vitess.io/vitess Go | From 0.20.0-rc1 | 0.20.4 |
vitess.io/vitess Go | From 0.20.0-rc1 | 0.20.4 |
vitess.io/vitess Go | From 0.21.0-rc1 | 0.21.1 |
1 more packages
vitess.io/vitess Go | From 0.21.0-rc1 | 0.21.1 |
How do I fix CVE-2024-53257?
Upgrade vitess.io/vitess to a fixed version for your release line: 0.19.8, 0.20.4 or 0.21.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-53257 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53257 exists.
Sources
Also known as AZL-53970, AZL-53977, GHSA-7mwh-q3xm-qh6p, GO-2024-3306.